apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: clinic-external-secrets-operator
spec:
  generators:
    - list:
        elements:
          - env: prod-cloud
            cluster: prod-clinic-cloud
            vesrion: 1.0.0
          - env: prod-op
            cluster: prod-clinic-op
            vesrion: 1.1.1
  template:
    metadata:
      name: "{{env}}-clinic-external-secrets-operator"
    spec:
      project: default
      sources:
        - chart: external-secrets
          repoURL: https://charts.external-secrets.io
          targetRevision: "{{vesrion}}"
          helm:
            releaseName: external-secrets
            valueFiles:
              - $values/clinic/external-secrets-operator/values/{{env}}/values.yaml
        - repoURL: https://github.com/tidbcloud/app-delivery.git
          targetRevision: HEAD
          ref: values
      destination:
        namespace: external-secrets
        name: "{{cluster}}"
      # cert-controller injects webhooks[].clientConfig.caBundle on the cluster; Helm manifest has
      # only service — Argo CD would stay OutOfSync otherwise (see external-secrets#1026).
      ignoreDifferences:
        - group: admissionregistration.k8s.io
          kind: ValidatingWebhookConfiguration
          name: secretstore-validate
          jqPathExpressions:
            - .webhooks[].clientConfig.caBundle
        - group: admissionregistration.k8s.io
          kind: ValidatingWebhookConfiguration
          name: externalsecret-validate
          jqPathExpressions:
            - .webhooks[].clientConfig.caBundle
      syncPolicy:
        automated:
          selfHeal: true
          prune: true
        syncOptions:
          - CreateNamespace=true
          - PruneLast=true
          - ServerSideApply=true
        retry:
          limit: 5
          backoff:
            duration: 5s
            factor: 2
            maxDuration: 3m